In the field of avionics, it has always been of high priority and great interest to focus on the reliability of electrical systems. It is, of course, of great importance that each system is reliable in an aerial vehicle in order to have the flight function properly. Generally, the reliability has been solved by providing backup systems to main systems, wherein the backup system takes over the control when a main system is rendered inoperative. However, introducing backup system to the main systems generates high costs, increasing weight as well as volume and reduces the Mean-time-between-failures, MTBF, for the complete system. The reliability is, hence, a parameter that is under continuous development in order to solve the problem and keep the costs at a minimum. One should understand that the cost of duplication of hardware and the like is very high and it is desired during new constructions as well as development of existing systems to avoid an increase of the costs. In civil aircraft design there is a desire to hold down the costs as well as the weight while enhancing safety and reliability.
Often, aircrafts of today use a flight control system architecture that simplified can be described in accordance with prior art shown in FIG. 1. FIG. 1 shows a flight control system 1 according to prior art. A number of sensors 5,6,7,8,9,10 are provided in the aircraft for measuring, indicating or the like, data of the vehicle. These sensor data are fed to three different channels 2,3,4 either directly or over a cross channel data link CCDL 11. Each channel controls a unique set of servomechanisms of the aircraft. In general, each channel contains two digital control modules DCM 12,13,14,15,16,17 that form a COM/MON pair, that is, a DCM monitors itself and when an error is detected the DCM becomes silent and the other DCM is selected as the operative DCM. A DCM comprises processors that calculate, for example, control commands for the actuators, such as servos and the like. In the illustrated example, DCM 12 and DCM 13 of the first channel 2, each send a control command to an Actuator Control Module ACM 18. The ACM 18 receives a control command from the first DCM 12 as well as from the second DCM 13. ACM 18 is configured to use the command from the first DCM and if the first DCM 12 becomes silent the ACM 18 switches to use the other control command coming from the second DCM 13. The ACM 18 uses the control command to control the illustrated actuators 21,22 to desired position. The ACM 18 monitors certain parameters related to the actuator 21,22, for example, actuator position. This data is sent to the DCM 12,13. Then, the DCMs 12,13 use the actuator data for monitoring purposes.
Either the DCM 12 or the DCM 13 controls the actuator 21, depending on which DCM the ACM is using, and the active DCM, that is, the DCM that generates the value the ACM is using, also controls an actuator mode valve of the actuator. The actuator mode-valve is used to select an actuator mode of the actuator arrangement. The actuator can be set in two different modes, a first mode called Normal mode, and a second mode called Damped mode. In the Normal mode the actuator 21 follows the control command coming from the second channel 2, that is, the second channel 2 controls the actuator 21. In the Damped mode, the actuator 21 is permitted to follow the airstream along the wing and does not affect the aerial vehicle, that is, the actuator 21 is set to be passive. The mode valve is switched from the Normal mode to the Damped mode when an error occurs in the actuator or ACM arrangement, for example a malfunction, an actuator hardover or the like.
The described prior art implies that when an error occurs in the DCM 12 of the first channel one can not initiate a flight since a failure of the second DCM 13 would mean that the performance of the aerial flight vehicle would deteriorate, wherein an operator or control system of the aerial vehicle would not be able to control the actuators 21 and 22 of the first channel. Furthermore, which is much more serious, the safety requirements cannot be upheld when only one DCM of the channel is working.
It is therefore an object of the present invention to provide a system that is more reliable and robust to occurring errors in control modules of a flight control system.